Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

CVEs (1,467)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-28131 1Expo 1Expo Software Development Kit Jun 17, 2026 Apr 24, 2023 N/A· v4 9.6 CRITICAL· v3 N/A· v2 A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achi...Show more A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc).Show less
CVE-2021-33589 1Ribose 1Rnp Jun 17, 2026 Apr 21, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of the algorithm.
CVE-2023-25760 1Uniguest 1Tripleplay Jun 17, 2026 Apr 19, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords via a crafted request payload
CVE-2022-4308 1Secomea 1Gatemanager Jun 17, 2026 Apr 19, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.
CVE-2023-25413 1Aten 1Pe8108 Firmware Jun 17, 2026 Apr 11, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. The device allows unauthenticated access to Telnet and SNMP credentials.
CVE-2023-25407 1Aten 1Pe8108 Firmware Jun 17, 2026 Apr 11, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials.
CVE-2023-1574 1Devolutions 1Remote Desktop Manager Jun 17, 2026 Apr 2, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive info...Show more Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windows allows an attacker with access to the user interface to obtain sensitive information via the error message dialog that displays the password in clear text. Show less
CVE-2022-48433 1Jetbrains 1Intellij Idea Jun 17, 2026 Mar 29, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
CVE-2023-1518 1Cpplusworld 1Kvms Pro Jun 17, 2026 Mar 28, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently protected.
CVE-2023-1137 1Deltaww 1Infrasuite Device Master Jun 17, 2026 Mar 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation...Show more Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.Show less
CVE-2023-25686 1Ibm 1Security Key Lifecycle Manager Jun 17, 2026 Mar 21, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 247601.
CVE-2023-0457 1Mitsubishielectric 38Fx5 Enet/ip Firmware Fx5 Enet FirmwareFx5s 30mr/es Firmware+35 more Jun 17, 2026 Mar 3, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext...Show more Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.Show less
CVE-2022-45599 1Aztech 1Wmb250ac Firmware Jun 17, 2026 Feb 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileges only when specific conditions regarding a given accounts...Show more Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileges only when specific conditions regarding a given accounts hashed password.Show less
CVE-2022-41614 1Intel 1On Event Series Jun 17, 2026 Feb 16, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-40678 1Fortinet 1Fortinac Jun 17, 2026 Feb 16, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow...Show more An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.Show less
CVE-2022-43969 1Ricoh 77Im 2500 Firmware Im 2702 FirmwareIm 3000 Firmware+74 more Jun 17, 2026 Feb 16, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials.
CVE-2023-24498 1Netgear 1Prosafe Fs726tp Firmware Jun 17, 2026 Feb 15, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.
CVE-2023-23466 1Mediacp 1Media Control Panel Jun 17, 2026 Feb 15, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Media CP Media Control Panel latest version. Insufficiently protected credential change.
CVE-2023-23463 1Sunellsecurity 7Sn Adr3804e1 Firmware Sn Adr3808e1 FirmwareSn Adr3808e2 Firmware+4 more Jun 17, 2026 Feb 15, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request.
CVE-2023-25191 1Ami 1Megarac Sp X Jun 17, 2026 Feb 15, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.

Previous 1...293031...74 Next